20 topics
Cybersecurity help, starting with why a hash is not encryption
A hash is not encryption, and almost every mark lost on a first security midterm traces back to treating it as though it were. Encryption is reversible by design because someone has to read the message later. Hashing is deliberately one-way, which is exactly why passwords are stored that way and why nobody, including the server, can hand your old password back to you.
Where students get stuck
If the site can check my password, why can't it tell me what it was?
Because it never stored the password. It stored the output of a one-way function. When you log in, it runs the same function on what you just typed and compares the two outputs. Matching outputs means matching inputs, and that is all the server ever needs to know. There is no key that undoes the function, so a stolen database gives an attacker a pile of hashes rather than a pile of passwords. That is also why a real reset link creates a new password instead of mailing you the old one.
Why is the salt stored in plaintext right next to the hash?
Because a salt is not a secret, it is a uniqueness device. Without one, two users who chose the same password get identical hashes, and an attacker can precompute a table once and crack millions of accounts with it. A random salt per user means the attacker has to redo the whole brute-force effort for every single row, even if they can read every salt. Keeping the salt secret would add almost nothing; making it unique per user is what destroys the economics of the attack.
Public-key crypto: I never know which key to use
Work out the goal first, then the key follows. If the goal is confidentiality, you encrypt with the recipient's public key, because only their private key undoes it. If the goal is authenticity, you sign with your own private key, because anyone holding your public key can verify it and nobody else could have produced it. The rule of thumb: the key you use is always the one that only the person making the claim could possess. Confidentiality points at the receiver, signatures point at the sender.
Why don't escaped quotes fix SQL injection?
Because escaping is a patch on a design problem. Injection happens when data and code travel in the same string, so the database parser has to guess which is which. Filtering quotes fails on numeric fields, on second-order injection where the payload is stored first and concatenated later, and on any encoding you did not anticipate. Parameterised queries fix it structurally: the query is compiled with placeholders, then the values arrive separately and are never parsed as SQL. There is nothing left to escape.
The CIA triad feels like memorised vocabulary
It is useful only when you use it to classify an attack you are looking at. Ask which of the three broke. A stolen customer list broke confidentiality. A tampered bank balance broke integrity. A flood of traffic that knocks the site offline broke availability, and note that it broke nothing else — the data is fine. The point is that controls trade against each other. Aggressive backups help availability and create more copies to keep confidential. Naming the property under attack is what tells you which control to reach for.
What's covered
Cybersecurity topics you can work through with a tutor, generate practice on, or turn into flashcards and a study plan.
Cryptography
- Symmetric ciphers: AES and block modes
- Public-key cryptography: RSA and Diffie–Hellman
- Hash functions, salting, and password storage
- Digital signatures and certificates
- TLS handshakes and the chain of trust
Attacks and defences
- SQL injection and parameterised queries
- Cross-site scripting and CSRF
- Buffer overflows and memory safety
- Phishing and social engineering
- Malware, ransomware, and botnets
- Denial of service and rate limiting
Networks and systems security
- Firewalls, DMZs, and network segmentation
- Intrusion detection and logging
- VPNs and secure tunnelling
- Access control models and least privilege
- Authentication, MFA, and session management
Governance and practice
- Threat modelling and the CIA triad
- Risk assessment and incident response
- Ethical hacking and penetration testing
- Privacy law, PIPEDA, and disclosure duties
Cybersecurity questions
Will it teach me how to actually hack something?
It will explain how an attack class works, because you cannot defend against something you do not understand, and every course covers it. It will not help you run one against a system you do not own. Lab environments your course provides are fine to work through out loud.
Can it check the code in my secure coding assignment?
Share your screen and it reads the file with you, pointing at the line where untrusted input reaches a sensitive sink. Injection and overflow bugs are far easier to spot on a shared screen than to describe from memory.
How do I revise all the acronyms before the exam?
Build flashcards from your own slide deck rather than a generic set, then use the arcade games on the same deck. Security courses are acronym-heavy, and recall under time pressure is a different skill from recognising a term in a list.
Is this useful for Security+ or a college networking security course?
The cryptography, access control, and attack-class material above lines up with both. Bring the exam objectives or the course outline to a session and work through the topics you cannot yet explain aloud.
Stuck on cybersecurity right now?
Talk it through out loud, share your screen, and watch it worked out step by step on a whiteboard.
Start free — no card